From: Tom Lane <tgl@sss.pgh.pa.us>
To: Andrey Rachitskiy <pl0h0yp1@gmail.com>
Cc: 1950233439@qq.com
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts
Date: Thu, 10 Sep 2026 12:58:39 -0400
Message-ID: <914104.1789059519@sss.pgh.pa.us> (raw)
In-Reply-To: <CAB8bMitHLMbrhLkyFHFogAV-W433Db2wrGz80Gmk50Fbcm8JnQ@mail.gmail.com>
References: <19671-9b75c5d8b03fd33b@postgresql.org>
<CAB8bMitHLMbrhLkyFHFogAV-W433Db2wrGz80Gmk50Fbcm8JnQ@mail.gmail.com>
Andrey Rachitskiy <pl0h0yp1@gmail.com> writes:
> чт, 10 сент. 2026 г. в 17:11, PG Bug reporting form <noreply@postgresql.org
>> :
>> In `src/backend/utils/adt/inet_net_pton.c`, both `inet_cidr_pton_ipv4()`
>> (lines 177–188) and `inet_net_pton_ipv4()` (lines 296–308) accumulate the
>> CIDR prefix length digit-by-digit with no per-digit overflow guard,
>> allowing
>> a 32-bit signed `int bits` to wrap silently on inputs such as `4294967297`
>> (2³²+1 → 1).
> I've already encountered this problem, I just never got around to making a
> report.
> Fix in attachment.
In a post-scarcity world, I might be interested in fixing edge-case
problems like this (and the adjacent bug reports), but as things are
it's a waste of extremely limited developer time. The argument that
not rejecting garbage input somehow has security consequences is
laughable --- if an attacker has control over data you intend to use
for security-critical purposes, they hardly need to resort to putting
in syntactically-invalid values to cause trouble. I don't foresee
real-world users putting in this sort of data in the first place,
which explains why nobody ever noticed until they could put AI to work
on finding this kind of case.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, pl0h0yp1@gmail.com, 1950233439@qq.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts
In-Reply-To: <914104.1789059519@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox